Privacy Policy

Last updated: 26.10.2026

1. Data controller

1.1 The controller of your personal data is NOARhouse OÜ (registry code 17323262, registered address Uus tn 22, 10111 Tallinn, Estonia; boutique Suur-Karja 2, 10140 Tallinn, Estonia; email hello@curatedbynoar.eu, phone +372 5354 9954), trading as Curated by NOAR ("NOAR"). NOARhouse OÜ is not VAT registered.

1.2 NOAR processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR") and the Estonian Personal Data Protection Act. For data protection enquiries, please write to hello@curatedbynoar.eu.

2. Personal data processed by NOAR

NOAR processes the following categories of personal data:

  • contact and order data: name, email address, phone number, delivery and billing address, selected parcel locker, and order contents and history (orders can be placed as a guest without creating an account);
  • payment data: payment status, payment method, amount and date (bank and card details are processed by Montonio Finance OÜ or in-store by SumUp; NOAR does not see or store card details);
  • communication data: emails, enquiries, withdrawal notices and claims;
  • newsletter data: email address, where you have consented to receive the newsletter;
  • consignment data, if you consign a piece with NOAR: name, contact details, bank account number, consignment agreement and payout records;
  • technical data and cookies: IP address, device and browser information, and website visit data.

3. Purposes and legal bases of processing

  • Order fulfilment, delivery, payment processing, returns, claims and consignment agreements: performance of a contract and steps prior to entering into a contract (GDPR Art. 6(1)(b)).
  • Accounting records and other statutory obligations: compliance with a legal obligation (GDPR Art. 6(1)(c)).
  • Customer support, fraud prevention, and the security and operation of the online store: legitimate interest of the controller (GDPR Art. 6(1)(f)).
  • Newsletter, direct marketing, and analytics and marketing cookies: consent of the data subject (GDPR Art. 6(1)(a)). You may withdraw your consent at any time.

4. Recipients and processors of personal data

NOAR shares personal data only to the extent necessary for the purposes listed above:

  • payment service providers: Montonio Finance OÜ (online bank links, card payments, Apple Pay and Google Pay) and SumUp EU Payments UAB (in-store card payments at the boutique); NOARhouse OÜ is the controller of personal data and transfers the personal data necessary for processing payments to its processor, Montonio Finance OÜ, which may also act as an independent controller when fulfilling its own statutory obligations;
  • online store platform and hosting: Shopify International Ltd.;
  • carrier: AS Eesti Post (Omniva), to whom NOAR provides your name, phone number, email address and delivery address for parcel delivery, and customs declaration details for shipments outside the European Union;
  • email, productivity and analytics providers: Google Ireland Limited (Google Workspace, Google Analytics) and Meta Platforms Ireland Limited (Meta Pixel, subject to cookie consent);
  • accounting service provider for statutory bookkeeping and tax reporting;
  • public and supervisory authorities where disclosure is required by law.

NOAR does not sell your personal data to third parties.

5. Transfers outside the European Economic Area

Some service providers may process data outside the European Economic Area, including in the United States. Where this occurs, safeguards under Chapter V of the GDPR are applied, in particular a European Commission adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses approved by the European Commission. When NOAR ships an order outside the European Union, the data required for delivery and customs clearance is transferred to the carrier and customs authorities in the destination country as necessary for the performance of the contract.

6. Cookies

  • Strictly necessary cookies required for the functioning of the online store (such as basket, checkout and security cookies) do not require consent.
  • Analytics and marketing cookies are used only with your consent, which you can give or withdraw at any time via the cookie settings on the website.
  • You can also delete or block cookies in your browser settings.

7. Data retention

  • Order, consignment and accounting source documents: 7 years from the end of the relevant financial year, as required by the Estonian Accounting Act.
  • Data relating to claims and contractual disputes: until the expiry of the statutory limitation period for claims (generally 3 years under the Estonian General Part of the Civil Code Act).
  • Customer enquiries and correspondence that are not accounting source documents: up to 3 years from the end of the communication.
  • Newsletter subscriber data: until consent is withdrawn.
  • Cookies: for the duration specified in the cookie settings or your browser.

8. Your rights

Under the GDPR, you have the right to:

  1. access your personal data and obtain a copy of it
  2. request the rectification of inaccurate personal data
  3. request the erasure of your personal data where retention is not required by law
  4. request the restriction of processing of your personal data
  5. object to processing based on legitimate interest and to direct marketing
  6. receive your personal data in a structured, machine-readable format and transmit it to another controller (data portability)
  7. withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise your rights, please write to hello@curatedbynoar.eu. NOAR will respond without undue delay and in any event within one month of receipt of the request, in accordance with Article 12(3) of the GDPR.

9. Complaints and updates

9.1 If you believe that the processing of your personal data infringes your rights, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, www.aki.ee, info@aki.ee) or with a court.

9.2 NOAR may update this privacy policy from time to time. The current version is always published at www.curatedbynoar.eu.